CryptPad requires two domains for a secure setup as documented here - https://docs.cryptpad.fr/en/admin_guide/installation.html#admin-domain-config
Thought I will leave my notes here, in case, someone wants to set things up in the future outside Cloudron or maybe improve the Cloudron package.
For a start, the safe port configuration is not working. I have reported this upstream - https://github.com/xwiki-labs/cryptpad/issues/907
After integrating the upstream nginx config into the app, we are golden:
The failing tests are manual things a user has to do post installation. Will put a note about those in the docs.
OK, installation is secured now.